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S-¥ ^n^l^i ^« ^-f, ^ ^ £ a 0 ] 2.- ^^o] 

Tg^ ig^^ 7 }x)x) oy^ o.^ ^-^-^H ^ <|J*1 <^ 

[tfl5.3E] 

£. 4 

^ 2£, *fl<H*#, ^HJL-g-, i3^B, ^ S-E., ^1 
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^HJl^ ^^f-J. jL$i& ^ m\ sfl^i y 0 Vl w {METHOD TO DETECT 
MALICIOUS CODE PATTERNS WITH DUE REGARD TO CONTROL AND DATA FLOW} 

41. 

£ 4 ^ £ 4^ ^ ^fl^ ^l*>7l W tfl# ^«- 7 fl 

£ 5 ^ ^ t^^l *M ZLefls^) ^oj], 

£ 6 £r -g- ^<*f| 4^ ^ sflU^- ^l*>7l ^tt JL#:£°ltK 
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-SMI* H^J 



tf. ^?fl^ (scanning)^- -f-^r *\=L^^ 91*) (signature recognition)^ iL^I 

3-2.-3. A>-g-£]ZL 5ti ^ ^ 3£ ^^H^f. °1 w o V ^^r ^VM"^ ^ iaJELofl # 

^£7> BBT-SJ7 OV^ ^co} t^^tII *r &l=Rr 7MH ^cf. Zl 

<10> £31*1*1 ^ ^S^H^l tfltb 71^ 7H 1 " $^3*1 tfl°V 

-r-M- #^ «J£* ^ #*l*Rr H o u -l 0 14. °1 lM£r ^£7} ajja^ 

hh>s^1 -§:-§• iL°m, ^ -2-fh7 r ^tj-fe- ^-g- 7^1 ZL ^rf. u}eH , 
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<>1 y o v ^^ «hS *S^1- ^^Vfe *\]±.B- ^*ti ^ # sfe}- 

nlE^ e^^l^H ^^\f>\7] 33 -g-^ atHr 3^ 

£ 1 ^ 33 €"*H ^tb ^ ^H^H #3 ^IHI 7fl^# ^^^>7l 

^ l^JEL Jl#o] ^-u}^ OV^ ^.g. ^^ 7 1 i^SlHfe tiV^A] S\-S^X2]B]9^ 

^>°H ^t^r ^31 7> ^*fl*>^o) *ltf. ^1^, 4*3 Copy *)l4i = fe ^ 
^91 ^3.^H» ' L0VE-LETTER-F0R-Y0U . TXT . VBS ' s)-fe ^+}*}JL, 7*8 3] 

'Attachments. Add' ^i^b 3. sfH^r *flS ^Ir^^l ^ 7 3%M ^^rSLS.tf 

-g-*>7fl S]^, A^fe i3^B ^^*>J1 BSfe ol-g-o} s|-<3}-g- ^ «-^>^ 

#3l£fe nfl^c jr^ol ^T-fl^JE o]& ov^ i^c^L l}^H>}7] ufl-g-ofl ^ ^3 iLff- 
♦ JiolTfl °H #*fl 33 #3 «o V ^^r €^fl ^ *?> 0} 

*>-g-€ 4°^, 'fso', V, 'out', 'male' ^Tfl&fe «a*l 

*>^7>1- 3A}^-O.JL*), -£-7>1 ^^iiq- #3 ^-4* ^7> ^4. 

^.e-m, 32} ^ ^ ^ ^55.5: °Xo]x\±; c^^s] 7>^1ji at*. 

^^r7> ojS.^- SJ^iLS o] JjS. £>-cq £- 0 | ^ofls. ^ 3} o. 

3. *H^Vfe -2-^-* ^^>7fl ^th. £ 2 fe 33 ^ 7l«HH ^3 ^7> ^€ 
safe °fl<>l^-. ^sfl^ 33 ^ 71^^ 1^34 4«S«H1>H ^>-g-^ 
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th nslM-, Ein^l- *<*J*I|;5HS 33N*i ^ 'c'^ ^^|s)^o.H.S. ^ 

^^Al^^ ltsgo} 4^0^ . c . 7 ]. ^ s 43 ^ 7 M7l] <g ^ £ 3 

. ^eflo} ^3 1^0} < c <q 3^0^ . d . 7 ^ A ^ cf^ ^oln^ ^ ^o] <aj*l*}.*l 

Al tV^Jl^ jlb^h ^5M- ^ fiHg 3fl€ 

<14> ^7l«2f S-^^r ^*>7l iflSH -g- ^-^cH] 4=- ^]c^^4 ^Jr-g^ jib} 

2] S^o] t^ol^ ^q\% 7 >^m ^4-, 
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¥ M°l a.^ Tg^o)^ -§-<^ olfs]. 7^71 ^ ^-g-^- 

- T^o]^ ^<iJ*l ojS-Jlf H^-^ 7>^l^ - °-^V ^6\]*] ^ ^-^-O.^ 

Ei M oje^ ^o^-^Vofl ^ ^-o] ^ o}Jf ; ^ ^ s ^ 0 ] 

^0]^ ^Oj^ o]^ ^^1- ^ ^-Mfe sfl^ «I4^L 



<16> oi^K ^Jf€ %^*H ^Ml^l ^^^>7ls 

<17> a 4 £7 ^°fl tt)-e| ^ ^fl^^r #*l*>7l W cfl^- £-^-<>] ^£-7fl 

*] ^HS 3S. ^1^. ^, Si^l 3L^El H^r ^ 

Tisq- Sj<Hl ^ ^ ^ Tj7> *<im 7>^ 3*1*11- ^ 

<18> £ 4 ofl S.X\& 74^^ ^3.^B^1 ^fl*}^ ^ 7fl^ ^ i£^r ^7> & 

-§: 7>^1^7V^ c^^-fe 4 ^g^-^ M-¥^ -n% v *fl ^ ^ 91^. ^, ¥ 
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o] 3.^ <#^<£ 3-f(°l*r. 1 ^'ojB}- ^ *|-M-^ ^oIji 

o^tV ol^-nf tg^g. 3 -fr^'^ £ ^ 

-g-o^v 7M^1 ^ 3-f(°l*r, 4 -B-^'olHf ^£ 

<19> ^15. *)1 1 -fr^ «fl^ ^*}<1^ ^ £€-^1:^ ^ 

^ ^^Mr 2 #2] S 2= ^ 

A H 7>^ ^7M- ^ &t}. 4^M, A o V ^ *W const ant propagation) 

» €^7> £€■ ^ MsJtl-s] 

#4 (copy propagation)!- *r<8*H ¥ -9*8 ^#^5.^ 

^Hl o]s^ ^1HJ:#^H1 *fl^ ^fl c^km. ^^*Vr4. ojatf, ^ >§ 



5.5.^1 ^ *l%lsRr «V2} ^o] eflig- w^ofl ^ 

* cfl^Hfr ^HW. ^ #sRr 7>iL X# ofl ^E) Af-g-£]ji o}^ 7 j ^ 
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<22> i ) S 7> u °11 S^Sfe x^ -frUtt ^ 0 H 0 > 

<23> ii) sS^-El tHl °l=Tr -E^ ^5.<H1 tfl^M y^l ^^7> &<H°> 
<24> ofl^tfl, Jgvg- 5ELE1-I- 7>^tm-. 

<25> x = y 

<26> z = fso.getf i le(x) 

<27> -g-^Kg- - z = fso.getfileCy)^ ^ , x^ -fr^tl 

^ 3^*1) 'x - y'^r y\^\n °)%^ a 71^- ^ ^ 

^Hl ^>-g-4 ^» ^vfljL, *IM ^5l)£t ^Ji* ^sHjRfr 

(node) 7]- ^cf. ^>M-^ 7l-g- cf^- 7 )-g- ^)o] *m.o) z\)o] jr 

Cf. ^HflH7> ^H£* nfl, 7l£- SiHVfe ^-Jl*1 ^-A}^ ^a> 

<28> i n [Bj =7l^-#^B^^*S -a-jLtl: ^-a> 

<29> = 71^ 1-^ B 2] ^ -n-JL*!: 
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<30> c _gen[B] = 7]-g- -g-s] B «1M ^j^^l 

<3i> cJcilUB] = 7)^ ^ B Afl^-Tll ^-JlS1-€ 4^>> 

<32> oh, /^/g; <4 0 ^/#y ^ <^*HH 4^ ^ £H=K 

<33> n 

[^C^^ 1] ^ a predecessor of B . g 7 |. S^^eH A] <5}- ^-^o] 



<34> 



<35> : 

3, o4B]=c.MB]UWB]-c_M5]) 

- £€ .ol ^olTlM-, S-^f" ^ <>lf4 ^» 7}X}*\ °]%°] 3)*m 

¥ ^M^H ^^7> &<H<>) $1}. 



<37> tf=. SMI Ti^J- Sj°11 ^€ £f Tj7> ^-^^ 

^ ^Jiem^r 4^ £4. ^r, *fl 1 <&?fl*r ^)H-e]iE W : = { Si }, ^ £M ^ 
tg-o. o s ve)^ §eflzL IsEqual := true, ¥ i^E.*Hl ^fl^S"* #EflZL 
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I sL inked := false S. ^tb4. ^1 2 #3]^ WS-^-E] tb = # ?1MH *>^-cfl, 

<38> ojc^A-], *fl 3 cjTil^ V7> ^^ojjl C 7> ^ ^^HH, Sj ^5.7> 

^ IsEqual := false, zl^^I &31 c7> Sj^l^ IsLinked := true, 8£J1 C 7> 

i^M- oi^i ±^.7} o>M^ s.€- W°fl "4^. 

*H 4 #7flir 3*>» ^1^5>7l ^«fl ^ 2 p>xl^-o.S, 5 #7fl^r sLinked 

= true^lJi IsEqual = trueo"!^ ^ ^ Si** Sj^l^i ^<Htr 7># ^ o. 

< 39 > ^3LSl#2l ^1 3 #?1HH 'c7> VS] 1 ol ?A-& tj-^g- # *>M-« 

i=f. 

<40> i ) C 7> Efl^-g-ojjl V 7f ^ofl $l^r nfl 

<41> ii) C 7> ^ iE^ HS-A^S Jl#*}^ ^JMjl, V7> *fl^ ^ 5l# p ^ 

MAY_DEF(p) ^r*fl nfl 

<42> <*|7HH MAY_DEF(p) SS.a1^ pofl^i ^o)^ ^ oi^ i£^<4 ^-s 

^^-olnf. ol^J^ H^a]^ ^o]^ ^l^^^r, S#^°ll ^Efls. ^<H^ 

x}, nz]5i HSAl7^7> HSAl^^ MAY_DEF ^*fl^ ^ 

T^l^Vo] o]^.o]^ - olcl-. ^^i, ^ aH^ 

^ £^ ^Sa]^ Jl#ol q-EfM-^ Sfl^ i%^77}*\ &r^}x] <&5L MAY_DEF ^ 
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<43> ^ 7 ]9\ ^ 7lA}Wr ^m\7) ^SMxr £ 6 4 *3*>7> ^^>Cf. £ 

% V S^>^, ^<H*1 JL-g- ^-HflHl- ^W^(S610). o]o]a^ 

AflS.^; *|H « HHfl^7> ^4. n>^^o. S> ov^ all eh ^1^KS630). 
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1] 

, ¥ M^o] 2.=- ^^tb ^» 7>^1^ , 

^ ¥ 2-¥ ^Utt <>1#3|- Ufl* 7>*1*1 ^-£-*> 

£ JL3^ ^ sflifi « 0 V^. 

2] 

¥ S-¥ ^^l^*] °1#4 7 >X]^ ^^-ofl^ - - 

^ s.^ ^^tt 7>^i^i ^ ^4-^1^ n 
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#34" *}JLjL#^r ZLS]^ OV^ ^ a o V^. 
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[51^] 



[51 1] 



SetQsoj » CreateObjectCScripting.FileSystemObiect") 
Set difSYStam =Qsi.aetSpecia!Folder(1 ) 

Z=[]i3.GetFile(WScript.ScriptFullName) 
:>vddTsvstem&"W[ QVE-LETTER-FOR-YOU.TXT.VBS"& 
set foUt] = WScript.CreateObJectrOuth^k.ApplicatiorO 
set | male | - loutt Createltem(O) 
[ma^Attatchments.Add(g{^^ 
Imalejsend 



[51 2] 

. set c = f so.GetFi le(WScr ipt .Scr iptFul IName) 

set c = f so.GetFi le( test.txt ') 

c. Copy{ LOVE-LETTER-FOR-YOU . TXT . VBS ) 

[51 3] 

set c = fso.GetFi le(WScr ipt .Scr iptFul IName) 
d = c 

d. Copy( LOVE-LETTER-FOR-YOU . TXT . VBS ) 
[51 4] 



// S4cl OlgS- gfg 
// AHSSr c & §21 



SSr2| IE! 8IUb ^4012 ShUfe S^ei 9^ : M 
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IS. 5] 



SI 


a = 0 


S2 


If a > 0 then 


S3 


b = l 


S4 


C = 2 


S5 


End If 


S6 


d » 3 



6] 




S610 



S620 



S630 
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